Because security is not easy. Often when I ask these questions the responses range from not being worth bothering with because we still shop at Target, even though they've been hit, to just dealing with a breach after the fact, rather than being a little more proactive about it.

E.g. https://news.ycombinator.com/item?id=7920558

Like I said, security is hard. Microsoft is the only large corporate I know of with a published security development lifecycle, and while it's starting to benefit their products they're still not getting it 100% either. Security is also contentious, because doing it right means forsaking the idea of an MVP. It also requires design up front. And experience. These sorts of things are not exactly aligned with the hacker mindset, nor with startup culture.